Goldman pulls coding agents from non-engineers; one OpenAI token budget from December; Postman's quiet agent installs

🔥The one thing to know

🧭How teams are doing it

• Revolut — The fintech reports that making its own GPU-hosted GLM models the default for coding work — instead of commercial agents such as Claude Code — brought what it spends running AI coding down by about 90 percent inside a year. A named, dated datapoint for the self-host-versus-vendor conversation when your AI bill climbs or your data terms tighten. The figure is the company's own claim, reported by The Register; treat it as a data point, not an audited result. The Register via Techmeme

• Tano — The Pragmatic Engineer's $10,000 essay winner, engineer Neil Kakkar, contrasts four years at PostHog with eight months as first engineer at AI-native startup Tano: roughly ten times the pull-request volume, reviews optional once an engineer knows the codebase, and an automated review agent on every PR with no human review in most cases. A concrete, self-measured account of what dropping human review buys — a lower reported revert rate than PostHog's and a median merge under an hour — and what it costs. He was merging 8–20 PRs a month at his old job; at Tano it is 200-plus. The Pragmatic Engineer

• Cognition — Cognition recaps the recent incident wave — the $6.34 billion Binance theft via compromised engineer laptops, the malicious Claude Code Cursor extension, the PHP flaw across much of the web — and pairs it with immediate and 30-day actions: scan developer machines for secrets, allowlist extensions, a seven-day minimum age for new packages, and agents moved off laptops into controlled cloud environments. Readymade, prioritised homework for the security meeting a Goldman-anxious leadership will ask for. Its blunt framing: an attacker needs no sophisticated AI to use a stolen credential or an unpatched server. Cognition

• Agent-written PRs outgrew hosted CI runners. A team whose coding agents open most of its pull requests ran into GitHub's hosted build-runner ceilings and has shifted CI to a single rented server. Its weekly PR count sat between 42 and 75 in June and hit 694 in the last week of October. If agent-driven PR volume multiplies, your build bill and runner capacity scale with it — worth a ceiling check before the queue backs up. Most of the PRs were agent-written and opened under staff names, per the write-up. Dark Factory Dev

🛠Agents and plans

• ChatGPT and Codex — From December, Plus, Pro and Business plans get a single usage allowance spanning both ChatGPT and Codex, counted in tokens, as the Work agent features fold into the main chat. OpenAI had already doubled the Work and Codex allowance on Pro 100, 200 and 500 plans on October 29. No per-plan token figures are published yet. Heavy Codex days will now eat the same budget as research and document work, so expect power users to hit resets; you cannot price seats against the change until the numbers appear. Instant chat stays outside the allowance; combined usage and reset times will show under Settings > Usage. BleepingComputer

• Claude Code v2.1.317 — Shipped November 3, with a cost report endpoint on the gateway admin API showing past spend by developer, day or identity-provider group over a date range, plus a prompt before a web or shell call sends your account email to the network, and a warning when a scheduled cloud task picks up connectors you never asked for. The spend endpoint is the visibility piece whoever owns your agent budget has been missing; the connector warning closes a quiet way cloud tasks accumulate access. Agent SDK hook callbacks can now block the action outright when they fail, instead of letting it proceed. GitHub

• Postman — The GitHub issue documenting it, opened October 25, is still open. Your team's agent configs are reachable by ordinary desktop software; audit what sits in ~/.claude and ~/.codex before assuming agent policy is yours alone to set. A remote Postman MCP connection was also enabled and failed authentication on startup, and the issue has drawn hundreds of reactions. GitHub

• Codex — A Hacker News thread reports that the setting controlling whether OpenAI trains on Codex chats appeared switched back on without the user's consent, and points readers to the ChatGPT settings toggle to check their own. OpenAI has not confirmed the claim, and commenters note retention quirks at other vendors too. Worth a five-minute check of the toggle if your team relies on those opt-outs to keep code out of vendor training — unconfirmed, but cheap to verify. Commenters cite FTC warnings to LLM providers about consent for data handling. Hacker News

• Cat Wu — The product lead for Claude Code and Cowork has left Anthropic, a month after Claude Code engineer Thariq Shihipar announced his own departure. The tool many teams standardise on has lost two familiar product names in a month — not a crisis, but worth watching for continuity on pricing and plan changes you may have budgeted around. Wu joined Anthropic in 2024 and helped scale Claude Code into one of tech's most-used developer products. Business Insider (via Techmeme)

💬What people are saying

• Jack Franklin — A Google senior engineer writes on LeadDev that with one engineer plus a frontier model able to span the whole stack, the tech lead's up-front coordination work has largely disappeared. The role now is holding the architectural bar, getting the right domain experts in front of AI-guided proposals, and building guardrails wherever an agent went off track. The clearest recent statement of the role shift your seniors are already feeling; useful when you next rewrite a tech-lead job description. His warning: dropping the quality bar for speed buys subtle bugs and lost understanding — the 4am page on a system nobody still knows. LeadDev

  “I'm finding my role in this era akin to a high level architect.”

🌍The big AI stories today

• GitBook — says an attack it describes as using AI agents took infrastructure credentials on November 2 and may have read Git Sync secrets and API tokens — rotate anything connected to it. Hacker News

• ChatGPT — reached 1.2 billion weekly users, with search-like queries about a fifth of Google's volume, OpenAI says — a marker of where people now look things up. Big Technology

• Cresta — Salesforce signed a definitive agreement to buy the voice-agent firm for a reported $2.7 billion, folding phone-based customer service into Agentforce — vendor consolidation pricing continues. Salesforce

• Google — will leave K-12 AI tools off by default next year, but schools opting out lose Google Search too, because search and AI now ship as one — bundling worth remembering. TechCrunch

💡One takeaway